AWS CodeBuild

What it is

AWS CodeBuild is a fully managed build service: it compiles source code, runs tests, and produces artifacts such as packages and container images, on build environments that it starts for each build and removes afterwards. A buildspec file in the repository says what to run. You pay for build time, and there are no build servers to manage.

Choose CodeBuild when a question asks to build, test, or package code or containers automatically, usually as the build and test stage of a CodePipeline release (MLA-C02 tasks 3.2.3, 3.3.2, and 3.3.4).

Concepts and features

• Buildspec (buildspec.yml): phases install, pre_build, build, and post_build with the commands to run; artifacts to keep; reports for test results; env for variables, including values from Parameter Store or Secrets Manager instead of plain text.
• Build environment: an AWS managed image (with common languages and Docker) or your own image from ECR; Linux, Windows, ARM, and GPUGPU (Graphics processing unit)A processor with thousands of small cores that run many calculations in parallel. GPUs speed up machine learning, graphics, and video work; EC2 instance families such as P and G include them.Glossary entryClose options; EC2 or Lambda compute, and reserved capacity for steady use.
• Containers: build Docker images for training and inference and push them to Amazon ECR; Amazon Inspector then scans them for vulnerabilities (task 4.3.1).
• Test reports: unit and integration test results (for example JUnit) and code coverage appear in the console, so a failed model or data test fails the build.
• Caching: cache dependencies in S3 or locally to make builds faster.
• VPC access: run builds in your VPC to reach private resources such as a package repository or database.

Security, resilience, performance, and cost

Security

Each build project uses a service role with least privilegeLeast privilegeGiving each person or system only the permissions it needs for its task, and no more. In IAM, this means starting with no access and allowing specific actions on specific resources.Glossary entryClose; artifacts and logs are encrypted with KMS; secrets come from Secrets Manager or Parameter Store; builds in a VPC reach private resources without the internet.

Resilience

Builds run on fresh, isolated environments; failed builds can retry; buildspec files are versioned with the code.

Performance

Choose a larger compute type for heavy builds, cache dependencies, and run test suites in parallel with batch builds.

Cost

You pay per build minute by compute type (and for reserved capacity if used). Cache dependencies and right-size compute to shorten builds.

Monitoring

Build logs go to CloudWatch Logs or S3; CloudWatch metrics show builds, duration, and failures; EventBridge reports build state changes.

Comparisons

Need	Choose
Build, test, and package code or images	AWS CodeBuild
Orchestrate the release from source to deploy	AWS CodePipeline
Deploy with traffic shifting and rollback	AWS CodeDeploy
Train a model on managed instances	SageMaker AI training jobs

Reverse mindmap: when the question points here

• Build and test
  • Run unit tests on each commit→ leads to Build stage with buildspec
  • Fail the build when tests fail, show results→ leads to Test reports
  • Build the inference container→ leads to Docker build, push to ECR
• Security
  • Database password in the build→ leads to Secrets Manager in buildspec env
  • Build needs a private package server→ leads to CodeBuild in a VPC
  • Scan the image for CVEs→ leads to Amazon Inspector on ECR

Key takeaways

• CodeBuild runs the phases in buildspec.yml on managed, short-lived environments.
• It builds and pushes training and inference containers to ECR and runs tests with reports.
• Secrets come from Secrets Manager or Parameter Store; builds can run in a VPC.
• Pay per build minute; cache to go faster.

Sources

• AWS CodeBuild User Guide: What is AWS CodeBuild?
• AWS CodeBuild User Guide: Build specification reference

Show 1 more sourceShow fewer sources

• AWS CodeBuild User Guide: Use AWS CodeBuild with Amazon Virtual Private Cloud